When is a volume eligible for Shadow Copies for Shared Folders?

There is a new feature in Windows Server 2003 that works almost like magic: you can automatically keep previous versions of your shared files. The feature is called Shadow Copies for Folders (in short, SCSF). Shadow copies are disabled by default, but you can enable it very easily on almost any volume in the system. All you have to do is to right-click the volume, select “Properties”, and then the Shadow Copies tab, and click the “Enable” button. Set it and forget it!

From this point on, your system will automatically keep previous versions in time for all files on this volume. Technically this is implemented using shadow copies, and by default there will be two shadow copies created by default per day: one at 7.00 AM (in the morning) and another one at 12.00 PM (right in the middle of the day). But you can se up a more frequent schedule if you like.

Now, I mentioned above that SCSF can be almost all volumes” and not “all volumes”. In what cases it doesn’t work? Here are the general rules that the Volume Shadow copy service uses to establish whether a volume is eligible for SCSF or not: 1) The shadow storage volume must contain enough free space. At the very minimum you need at least 300 MB or so, for a single shadow copy. For multiple shadow copies, the space can increase more or less, depending on the I/O usage. You can always run the command VSSADMIN LIST SHADOWSTORAGE to see how much space is used for the existing shadow copies and what is the projected usage in the future. Note, however, that you can enable SCSF on a certain volume, and keep the shadow storage on a completely different volume. In this case, there is no free space requirement for the first volume.2) Only fixed drives are supported. Therefore, you cannot enable SCSF on removable, floppy, thumb-drive, CD-RW, DVD-RW drives. Note however that Firewire or USB harddisks are still supported for SCSF. 3) Only volumes formatted with NTFS are supported. In other words you cannot enable SCSF on a FAT/FAT32 volume. 4) Volumes that are offline, non-responsive or disconnected are not supported.5) Only read-write volumes are supported. Read-only volumes are not supported. Yes, there is such a thing called “read-only NTFS” – in fact these shadow copies appear in the system as separate NTFS read-only volumes, with their own mounted file system.6) The Cluster Quorum volume is not supported.7) An Administrator removed the “Local SYSTEM” from the Access Control list of the root of the volume. Make sure that the SYSTEM account always has access to the roots of your volumes.

[update – Added a section about the free space and Local System, changing title]

To answer the first question: the shadow copies in SCSF use a differential copy-on-write mechanism for changes in the whole volume. So when you overwrite one byte in a file X, then you won’t have the whole file copied over – the system just keeps the differences.

On the second question: no – if you delete a file, the previous versions are still visible, if you right-click on the folder that contained the file.

Third question: If you want to delete a shadow copy, you can go to the "Shadow Copies" tab in the volume properties dialog, and manually delete these shadow copies. Anyway, by default, SCSF will used maximum 10% from the total volume size by default. When it runs out of those 10%, it will start deleting older shadow copies therefore making room for newer shadow copies.